HiveV5_keystream_decryptor

HiveV5 keystream decryptor PoC Introduction The Hive sample analyzed and referred to in this document was randomly chosen from this list created by @rivitna to which my warmest thanks go. Artifacts are available on the VirusTotal platform. In this document, file a0h2uih3d2.exe has been taken as a...

CVE-2026-95653 Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token

Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digit...

CVE-2026-59317

A flaw was found in Spring for Apache Kafka. The DeadLetterPublishingRecovererFactory component does not properly validate the retrytopic-original-timestamp header. A remote attacker can exploit this by sending a specially crafted message with a malformed header, leading to an infinite processing...

Linux Distros Unpatched Vulnerability : CVE-2026-90086

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xsk: honor XDPTXMETADATA in zero-copy path The zero-copy path reads TX metadata whenever the UMEM has metadata space, even if the descriptor does not set...

DEBIAN-CVE-2026-90086

In the Linux kernel, the following vulnerability has been resolved: xsk: honor XDPTXMETADATA in zero-copy path The zero-copy path reads TX metadata whenever the UMEM has metadata space, even if the descriptor does not set XDPTXMETADATA. Pass descriptor options through the metadata helpers and...

CVE-2026-81515

Steeltoe.Discovery.Eureka (versions 4.0.0 through 4.3.0) deserializes the Eureka registry response as a single unit. A malformed actionType , status , isCoordinatingDiscoveryServer , or timestamp field aborts the entire fetch, affecting the JsonInstanceInfoConverter , BoolStringJsonConverter , an...

kernel: net: guard timestamp cmsgs to real error queue skbs

A flaw was found in the Linux kernel's networking component. This vulnerability allows a remote attacker to potentially access sensitive information or cause system instability. By sending specially crafted network packets, an attacker can exploit an issue in how the kernel handles timestamping f...

kernel: net: guard timestamp cmsgs to real error queue skbs

A flaw was found in the Linux kernel's networking component. This vulnerability allows a remote attacker to potentially access sensitive information or cause system instability. By sending specially crafted network packets, an attacker can exploit an issue in how the kernel handles timestamping f...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nftables – Use a timestamp to check for set element timeout. A timestamp field was added at the beginning of the transaction; it is stored in the nftablespernetns area. The .insert, .deactivate, and syncgc functions...

CVE-2026-21391

creationtimestamp| type| source ---|---|--- 2026-09-14 12:33:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/4mojdw4nqgh7w 2026-09-14 13:30:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mvi7rcze6a2f 2026-09-14 14:07:14+00:00| seen|...

Astra Linux – Vulnerability in Firefox and Thunderbird

It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorrect timestamp being used to prevent input after the page loads. This vulnerability affects Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ice: The txtstamps field is set when creating new Tx rings using ethtool. When the user changes the number of queues via ethtool, the driver allocates new Tx rings. This allocation does not initialize the txtstamps field. As a...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15

In the Linux kernel, the following vulnerabilities have been resolved: TCP/UDP: Fixed memory leaks related to sk and zerocopy SKBS with TX timestamps. Syzkaller reported 0 memory leaks of an UDP socket and ZEROCOPY SKBS. We can reproduce this issue with the following sequence: sk = socketAFINET,...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net: enetc: avoid deadlock in enetctxonesteptstamp This lockdep message explains it better than I could: ================================ WARNING: inconsistent lock state 6.2.0-rc2-07010-ga9b9500ffaac-dirty 967 Not tainted...

CVE-2024-30350

creationtimestamp| type| source ---|---|--- 2026-09-14 03:00:14+00:00| seen| Telegram/SISeOiJWiDHPKa0-EGjfIE-tIZnqvMDmbIqcTRDP3O63UA 2026-09-15 00:00:22+00:00| published-proof-of-concept| Telegram/SISeOiJWiDHPKa0-EGjfIE-tIZnqvMDmbIqcTRDP3O63UA...

CVE-2026-89666

A flaw was found in the kernel. A remote attacker, acting as an NFSv3 client, can send malformed time values during SETATTR or create operations. This can lead to the corruption of on-disk metadata, resulting in incorrect timestamps for files. This issue affects filesystems that support nanosecon...

Linux Distros Unpatched Vulnerability : CVE-2026-89666

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtim...

CVE-2026-89701

A flaw was found in the Linux kernel's Network File System Daemon nfsd. The TIMEDELEGACCESS and TIMEDELEGMODIFY decode paths do not properly validate the nanosecond nseconds value in timestamps. This allows a remote attacker to provide a malformed timestamp, which can then be written to disk,...

CVE-2026-89666

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtime whose nseconds field is out of range. The value is well-formed on t...

DEBIAN-CVE-2026-89666

In the Linux kernel, the following vulnerability has been resolved: nfsd: reject out-of-range nseconds in NFSv3 SETATTR and create ops A client can send an NFSv3 SETATTR, CREATE, MKDIR, SYMLINK or MKNOD carrying an atime or mtime whose nseconds field is out of range. The value is well-formed on t...